CVE-2026-111282

HIGH 8.2

iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.

CWE	CWE-190
Vendor	driftregion
Product	iso14229
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for driftregion iso14229

Be the first to know when new high vulnerabilities affecting driftregion iso14229 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

driftregion / iso14229

0 < 0.10.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/driftregion/iso14229/security/advisories/GHSA-5hgv-5fqg-8vcr github.com: https://github.com/driftregion/iso14229/security/advisories/GHSA-ph4f-7v39-8hgm github.com: https://github.com/driftregion/iso14229/commit/2e36afcd7f0cd02b0c70446c1a265a7b1999d478 github.com: https://github.com/driftregion/iso14229/blob/0.10.0/src/server.c#L1151-L1161 github.com: https://github.com/driftregion/iso14229/releases/tag/0.10.1%2B9e7c47e8 github.com: https://github.com/driftregion/iso14229 vulncheck.com: https://www.vulncheck.com/advisories/iso14229-before-0.10.1-out-of-bounds-read-via-handle-0x38-requestfiletransfer

Credits

dyingman1 Ali Raza (@locus-x64)